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Recent  changes  to  US  space  policy  regarding  the  execution  of  satellite  End  of  Life  (EOL) 
procedures  have  been  driven  by  the  rising  significance  of  the  orbital  debris  problem  in  Low 
Earth  Orbit  (LEO).  Therefore  current  EOL  plans  are  written  largely  with  the  aim  of 
reducing  long-lasting  debris  that  can  linger  for  decades  in  the  orbit  of  the  defunct  satellite. 
Through  an  exhaustive  discussion  of  US  National,  Department  of  Defense  and  Air  Force 
Space  Command  policies  for  mitigation  of  orbital  debris,  this  paper  details  several 
considerations  for  writing  operational  EOL  plans,  with  special  applicability  to  military 
missions  and  focus  on  LEO  satellites  that  are  unable  to  relocate  to  a  graveyard  orbit. 
Further,  the  recent  ungainly  re-entry  of  NASA’s  Upper  Atmosphere  Research  Satellite 
(UARS)  has  highlighted  the  need  to  incorporate  debris  mitigation  into  the  EOL  plan  after 
contact  has  been  lost  or  during  re-entry  in  the  interest  of  public  safety.  In  light  of  this 
incident,  methods  currently  used  by  Air  Force  Orbital  Safety  professionals  to  assess  and 
minimize  orbital  debris  released  during  and  after  EOL  satellite  passivation  by  accidental 
explosions,  by  intentional  breakup  and  due  to  on-orbit  collisions  with  existing  debris  are 
discussed.  As  integral  parts  of  a  holistic  EOL  plan,  re-entry  survivability  analysis,  casualty 
expectation  analysis  and  intentional  breakup  activities  are  also  addressed. 


I.  Introduction 

THE  problem  of  orbital  debris  and  its  obstruction  to  clear  and  easy  access  to  space  has  long  been  an  item  of 
national  and  defense  interest,  not  just  in  the  United  States  but  in  space-faring  countries  around  the  world.  All 
Department  of  Defense  (DoD)  and  United  States  Air  Force  (USAF)  regulations  that  ensure  compliance  with  orbital 
debris  minimization  goals  stem  from  the  US  Government  (USG)  Orbital  Debris  Mitigation  Standard  Practices1 
(ODSPs).  This  high-level  document  addresses  how  all  American  space  programs  should  conduct  their  operations 
with  the  minimization  of  orbital  debris  in  mind.  The  USG  ODSPs  are  addressed  in  four  general  objectives: 

1 .  Control  of  debris  released  during  normal  operations 

2.  Minimizing  debris  generated  by  Accidental  Explosions 

3.  Selection  of  a  safe  flight  profile  and  operational  configuration 

4.  Post  mission  disposal  of  space  structures. 

This  paper  will  touch  mostly  on  the  fourth  objective,  i.e.,  the  mitigation  of  orbital  debris  at  satellite  End  of  Life 
(EOL)  or  end  of  mission,  and  the  implementation  of  space  policy  currently  in  place  on  such  operations.  Especially  at 
EOL,  when  control  over  the  space  vehicle  is  lost  due  to  low  altitude  or  given  up  due  to  end  of  mission  activities, 
minimizing  the  risk  of  debris  creation  due  to  accidental  explosions  and  maintaining  a  safe  operational  configuration 
are  relevant  concerns,  and  we  shall  address  them  accordingly  in  this  paper. 

The  President’s  National  Space  Policy2  directive  (2010)  recognizes  the  problem  of  orbital  debris  and  its  risk  to 
space  operations  and  national  interests,  and  directly  references  the  USG  guidelines  by  stating  that  “All  Departments 
and  Agencies  shall  continue  to  follow  the  US  Government  Orbital  Debris  Mitigation  Standard  Practices,  consistent 
with  mission  requirements  and  cost  effectiveness”.  The  USG  guidelines  are  therefore  the  most  general  policy-level 
dictation  of  EOL  activities.  A  lot  of  its  content  derives  from  the  United  Nations’  Space  Debris  Mitigation 
Guidelines3,  first  created  by  the  UN  Committee  on  the  Peaceful  Uses  of  Outer  Space  in  1999.  That  document 
addresses  the  orbital  debris  problem  via  seven  guidelines,  and  in  association  with  the  USG  ODSPs,  is  the  foundation 
for  NASA  orbital  debris  control  documentation  such  as  NASA  Procedural  Requirement  (NPR)  8715. 6A4,  “NASA 
Procedural  Requirements  for  Limiting  Orbital  Debris”.  While  the  focus  of  this  paper  is  the  implementation 
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stemming  from  Department  of  Defense  Instructions  (DoDIs)  that  arise  from  the  USG  Space  Policy,  the  NPRs  are 
also  an  example  of  implementation  of  policy  toward  orbital  debris  mitigation. 

DoDI  3100.10,  “Space  Policy”5  and  DoDI  3100.12,  “Space  Support”6,  are  the  primary  documents  responsible  for 
implementing  the  USG  ODSPs  into  DoD  space  operations,  just  as  NPR  8715. 6A  does  for  NASA.  Section  6.3  of 
DoDI  3100.12  contains  similar  language  to  the  ODSPs  with  regard  to  release  of  debris  during  normal  operations. 
This  drills  down  to  the  service  level  via  Air  Force  Instruction  AFI  91-21 77,  “Space  Safety  and  Mishap  Prevention”. 
In  general,  AFIs  may  be  more  but  not  less  restrictive  than  the  parent  DoDI  document.  AFI  91-217  contains  a  lot 
more  detail  and  addresses  a  wider  slew  of  case  scenarios  to  ensure  implementation. 

Similarly,  at  the  Major  Command  level,  these  manifest  as  Air  Force  Space  Command  Instruction  AFSPCI  10- 
1204s,  “Satellite  Operations”,  and  at  the  unified  command  level,  through  US  Strategic  Command  (STRATCOM) 
Instruction  SI  505 -49,  “Satellite  Disposal  Procedures”.  While  Air  Force  Space  Command  (AFSPC)  is  charged  with 
providing  and  maintaining  space  capabilities  for  the  joint  force  military,  STRATCOM  is  one  of  the  nine  unified 
DoD  functional  commands,  and  is  responsible  for  providing  strategic  deterrence  and  Command,  Control, 
Communications,  Computers,  Intelligence,  Surveillance  and  Reconnaissance  (C4ISR)  capabilities.  STRATCOM 
and  AFSPC  therefore  work  hand-in-hand  to  enable  mainstream  DoD  space  operations.  Their  guiding  policy 
documents,  stemming  from  national  level  policy  models,  seek  to  re-work  the  way  DoD,  USAF  and  AFSPC  conduct 
operations,  towards  a  more  responsible  role  in  lowering  the  creation  of  debris  in  commonly  used  orbit  regimes. 

This  paper  presents  the  impact  and  implementation  of  these  national  and  DoD  space  policy  documents  in  three 
phases.  Firstly  we  shall  examine  the  impact  of  policy  on  LEO  satellite  re-entry.  Next,  we  shall  examine  the 
implementation  piece  of  USAF  EOL  passivation  activities  and  associated  planning.  Finally,  other  methods  adopted 
from  the  intent  of  the  National  Space  Policy  Guidelines  within  the  operational  Air  Force  to  mitigate  the  creation  of 
orbital  debris  at  EOL,  as  well  as  the  concept  and  importance  of  “Design  for  Death”  will  be  discussed. 

II.  Impact  of  National  Policy  on  LEO  Satellite  Re-Entry 

We  begin  with  LEO  satellite  re-entry  for  an  important  reason:  per  the  USG  ODSPs  for  Debris  Mitigation, 
satellites  in  LEO  have  two  options  at  the  end  of  their  mission.  If  the  program  should  choose  to  place  the  satellite  in  a 
“storage”  orbit  to  dispose  of  it,  that  orbit  must  have  a  perigee  of  above  2000  km  and  an  apogee  altitude  below 
19,700  km1.  Since  LEO  can  range  anywhere  from  150  km  to  2000  km  in  altitude7,  realistically,  this  is  not  a  goal 
achievable  for  a  large  section  of  the  LEO  population,  either  due  to  fuel  or  mission  constraints.  This  is  especially  true 
in  the  case  of  Research  &  Development  (R&D)  satellites  that  are  often  single-string,  without  propellant,  or  both. 
Atmospheric  re-entry,  therefore,  is  the  preferred  option  for  EOL  available  to  most  LEO  satellites,  and  this  section 
will  discuss  the  policy  burden  of  that  option. 

A.  Satellite  Re-Entry  within  25  Years 

DoD  instructions  for  space  operations  attempt  to  limit  the  probability  of  collisions  and  explosions  post-EOL. 
According  to  DoDI  3100. 126  paragraph  6.4,  EOL  procedures  must  “leave  the  satellite  in  an  orbit  in  which,  using 
conservative  projections  for  solar  activity,  atmospheric  drag  will  limit  the  lifetime  to  no  longer  than  25  years  after 
completion  of  mission”.  NASA  also  has  adopted  similar  policies,  namely,  NASA  Policy  Document  NPD  8710. 3B10, 
“NASA  Policy  for  Limiting  Orbital  Debris  Generation”  and  NASA  Safety  Standard  NSS  1 740. 14 1 1  “Guidelines  and 
Assessment  Procedures  for  Limiting  Orbital  Debris”.  As  mentioned  previously,  AFIs  may  be  more  restrictive  than 
DoDIs,  and  the  USAF  imposes  an  additional  requirement  of  re-entry  no  more  than  30  years  after  launch  for  LEO 
vehicles,  atmospheric  re-entry  notwithstanding7.  It  also  further  restricts  the  apogee  of  LEO  orbits  to  18,400  km,  vice 
the  19,700  km  recommended  by  the  USG  ODSPs. 

The  End  of  Mission  plan  reviewed  by  the  Program  Manager  and  the  AFSPC  Office  of  Safety  needs  to  document 
compliance  with  this  and  all  other  regulations  discussed.  For  maneuverable  satellites,  while  this  plan  must  allow 
Orbit  Analysts  (OAs)  leeway  to  adjust  burn  times  and  orbital  positions  according  to  operational  needs  or  ground 
station  contact  times,  it  must  still  provide  sufficient  detail  to  prove  the  capability  to  re-enter  within  25  years.  For 
non-maneuverable  satellites,  this  can  be  more  of  an  issue.  LEO  satellites  with  perigee  altitudes  greater  than  700  km 
are  unlikely  to  re-enter  within  25  years  naturally,  using  conservative  projections  for  solar  weather;  therefore,  if  they 
have  none  or  insufficient  propellant  to  stage  a  controlled  re-entry,  they  are  unlikely  to  ever  get  the  green  light  to 
launch  via  the  DoD. 

This  altitude  “restriction”  is  a  significant  limiting  factor  for  low  budget,  R&D -mission  satellites.  While  the  USG 
guidelines  leave  some  measure  of  leniency  to  orbital  debris  mitigation  for  “cost  efficiency”  considerations,  AFI  91- 
217  specifically  calls  out  that  all  Air  Force  space  systems,  including  R&D  systems,  must  comply  with  their 
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requirements  and  similar  ones  imposed  by  STRATCOM9,  leaving  only  the  tenuous  safety  waiver  process  as  a 
possible  way  forward  for  non-compliant  low-budget  systems. 

B.  Re-Entry  Survivability  Analysis  and  Casualty  Expectation 

Even  after  space  vehicle  breakup  in  the  upper  atmosphere  during  re-entry,  certain  component  parts  made  out  of 
tungsten,  titanium,  stainless  steel,  beryllium  or  carbon-carbon  may  not  reach  their  melting  point  by  aero  heating.  In 
many  cases  these  components  survive  re-entry,  which  has  led  to  the  study  of  “casualty  area”.  The  recent  ungainly 
entry  of  NASA’s  Upper  Atmosphere  Research  Satellite  (UARS)  was  a  stark  highlight  of  the  public  significance  this 
area  can  take  on.  A  measure  of  satellite  survivability  during  uncontrolled  entry  and  break-up,  casualty  area  is 
defined  as  the  area  around  a  debris  impact  point  within  which  a  person  present  will  become  a  casualty  . 

NASA  has  chosen  to  exercise  control  over  casualty  expectation  through  casualty  area.  NASA  Safety  Standard 
NSS  1740. 1 4 1 1  Section  7  narrows  the  maximum  casualty  area  permissible  for  a  re-entering  body  to  8  m2.  DoDIs  do 
not  mention  a  limit  for  casualty  area,  focusing  instead  on  “casualty  expectation”.  This  is  defined  as  the  average 
number  of  casualties  that  can  occur  as  a  result  of  a  re-entry  event  if  the  event  were  to  be  repeated  thousands  of  times. 
DoDI  3100.126  sets  the  maximum  casualty  expectation  at  no  greater  than  1  in  10,000.  Neither  DoDIs  nor  NSSs 
require  a  controlled  re-entry  to  guarantee  that  it  will  avoid  inhabited  areas,  unless  the  casualty  expectation  is  above 
this  limit.  At  that  point  the  satellite  will  be  required  to  budget  propellant  for  a  final  entry  maneuver  that  will  steepen 
the  flight  path  angle  and  allow  for  Earth-impact  at  a  selected  longitude  and  latitude,  most  likely  in  the  Pacific  Ocean. 
Therefore,  a  military  or  military-affiliated  non-maneuverable  satellite  must,  from  design  inception,  meet  these 
casualty  expectation  criteria;  another  example  of  increasing  regulatory  demand  on  satellites  designed  on  low 
budgets  with  no  propulsion. 

An  example  of  the  divergence  between  the  NASA  and  DoD  casualty  expectation  standards  are  the  Air  Force 
standard  Delta  launches.  Delta  II  second  stages,  for  example12,  have  a  casualty  area  of  10.8  m2.  However,  as  DoDIs 
only  enforce  a  maximum  casualty  expectation  instead  of  casualty  area,  Delta  II  and  Delta  IV  vehicles  do  not  have  to 
comply  with  NSS  1740.14.  Further,  if  the  body  has  the  ability  to  control  its  own  re-entry  and  can  do  so  over  a  non- 
populated  or  ocean  area,  even  the  casualty  expectation  of  less  than  1  in  10,000  may  be  waived.  Therefore,  after 
releasing  their  payload  to  LEO,  these  Delta  motors  can  reignite  their  own  second  stages  and  stage  a  controlled  re¬ 
entry  over  the  Pacific  Ocean. 

Every  component  piece  of  the  re-entering  spacecraft  bus  and  payload  must  be  modeled  to  determine  its  ablation 
temperature,  demise  altitude  (measure  of  survivability)  and  casualty  area.  An  example  of  this  analysis  can  be  found 
in  the  literature13.  From  this,  a  picture  of  surviving  pieces  can  be  drawn. 

The  distribution  of  population  can  be  plotted  against  orbital  inclination  by  year.  When  this  population  density 
number  is  multiplied  by  the  summed  casualty  area  of  all  re-entering  parts,  the  total  casualty  expectation  for  random 
re-entry  during  a  particular  year  can  be  calculated  as: 

Expected  Casualty  =  Casualty  area  (m2)  *  Population  density  (1/m2)  (1) 

There  are  several  approved  software  packages  that  can  calculate  measures  of  survivability  based  on  various 
criteria:  Object  Re-entry  Survival  Analysis  Tool  (ORSAT),  Spacecraft  Atmospheric  Re-Entry  and  Aero-thermal 
Breakup  (SCARAB),  Spacecraft  Entry  Survival  Analysis  Module  (SESAM)  and  NASA’s  Debris  Assessment 
Software  (DAS)  are  some  of  these.  Lips14  performs  an  excellent  comparison  of  the  fidelity  and  results  of  these 
various  tools. 


III.  Impact  of  National  Policy  on  EOL  Passivation 

As  discussed  earlier,  standard  practices  for  orbital  debris  mitigation  in  LEO  dictate  relocation  to  an  often 
unachievable  orbit.  Satellites  are  therefore  commonly  decommissioned  in  orbits  that  will  ensure  de-orbit  due  to 
atmospheric  drag.  Satellites  can  remain  for  a  long  time  in  this  adverse  environment  where  collisions  with  space 
debris  or  meteoroids  and  the  high  temperature  changes  (thermal  cycling)  between  sunlit  passages  and  eclipses  could 
exert  stresses  sufficient  to  trigger  a  break-up. 

The  largest  percentage  of  catalogued  space  debris  population  can  be  traced  to  the  fragmentation  of  spacecraft 
and  launch  vehicle  orbital  stages2,3.  The  majority  of  these  breakups  were  unintentional,  many  arising  from  the 
abandonment  of  spacecraft  and  launch  vehicle  orbital  stages  with  significant  amounts  of  stored  energy.  Therefore, 
debris  mitigation  after  contact  has  been  lost  or  during  re-entry  must  be  actively  considered  as  part  of  an  EOL  plan. 


From  http://www.space.gov.au/SpaceLicensingSafetyOffice/Documents/FSC_Pubnl_20050602105043.pdf 
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The  most  effective  method  of  mitigation  is  passivation,  which  requires  the  removal  of  all  forms  of  stored  energy, 
including  residual  propellants  and  compressed  fluids  and  the  discharge  of  electrical  storage  devices.  This  is 
specifically  called  out  in  the  USG  ODSPs,  under  the  objective  of  minimizing  debris  caused  by  accidental 
explosions.  Section  2.2  directly  states  that  all  on-board  sources  of  stored  energy  of  a  spacecraft  or  upper  stage 
should  be  depleted  or  safed  when  no  longer  required1'2,  dictating  that  the  impact  of  an  unavoidable  subsequent 
explosion  be  reduced  however  possible. 

Therefore,  we  shall  discuss  the  implementation  of  this  policy  directive  via  passivation.  However,  passivation  is  a 
design  process.  If  not  carefully  considered,  the  satellite  could  still  be  at  a  reasonably  high  energy  state.  We  shall 
address  this  issue  in  three  parts  -  pre -passivation  planning,  which  can  be  highly  dependent  upon  the  components  on¬ 
board;  the  passivation  checklist  process  and  concerns  to  address  while  designing  that  process,  as  well  as  the  post¬ 
passivation  concerns  raised  by  the  USG  ODSPs. 

A.  Pre-Passivation  -  Planning  EOL  around  Spacecraft  Components 

The  components  onboard  a  spacecraft  have  a  large  role  in  determining  the  level  of  detail  that  must  go  into  EOL 
planning.  As  discussed,  one  of  the  primary  drivers  is  minimizing  the  destructive  capability  of  satellite  components 
after  contact  with  the  parent  vehicle  is  no  longer  possible.  The  large  amount  of  debris  floating  in  LEO  makes  impact 
with  the  satellite  at  some  later  point  in  its  25-year  orbit  almost  inevitable.  A  collision  that  produces  an  explosion  due 
to  the  satellite  being  in  a  high-energy  state  can  create  thousands  of  debris  particles  that  will  linger  in  the  orbit  of  the 
erstwhile  satellite  and  become  a  hazard  to  future  missions. 

Therefore  every  stored  energy  source  must  be  deactivated  or  dissipated  to  the  maximum  extent.  Today,  if  any  of 
the  following  components  are  present  aboard  the  spacecraft,  mitigation  measures  should  be  addressed  as  part  of  the 
EOL  plan13. 

1.  Fluids.  Fluid  and  thermal  management  issues  aboard  the  spacecraft  must  be  addressed.  Cryogenic  liquids,  in 
particular,  have  been  widely  used  aboard  scientific  missions,  and  are  stored  in  various  hazardous  states.  Some 
examples  include  high-pressure  Joule-Thomson  expansion  devices  for  cooling  of  infrared  or  hyperspectral  detectors, 
or  storage  of  super-critical  low-pressure  helium  to  provide  oxygen  and  nitrogen  for  manned  missions'3.  The  design 
for  cryo-coolers  on  a  short-term  mission  may  be  different  from  those  on,  say,  the  International  Space  Station,  and 
the  means  by  which  these  devices  will  be  safed  or  jettisoned  must  be  addressed  accordingly. 

2.  Propellant.  Every  maneuverable  satellite  should  have  a  AV  budget  dedicated  exclusively  to  EOL  operations. 
Once  a  degenerating  or  disposal  EOL  orbit  has  been  achieved,  fuel  onboard  must  be  jettisoned  to  the  maximum 
possible  extent.  For  example,  CloudSat,  a  NASA  Earth  Science  Pathfinder  mission  launched  in  2006,  uses  a 
diaphragm  that  will  aid  in  expulsion  of  remaining  hydrazine  fuel;  however  approximately  0.5  kilograms  will  remain 
trapped  between  the  fuel  tank’s  inner  wall  and  diaphragm16.  To  mitigate  this,  the  satellite  was  designed  with  latch 
valves  that  will  close,  in  addition  to  the  thruster  valves,  to  prevent  excess  hydrazine  from  escaping.  In  the  event  that 
design  does  not  permit  such  mitigation,  further  perigee  lowering  maneuvers  are  an  excellent  way  to  burn  off  excess 
fuel  and  fulfill  the  DoD  burn-in  requirement. 

3.  Pyrotechnic  Devices.  Spacecraft  utilize  pyro  or  firing  circuits  for  functions  such  as  severable  bolts  to  jettison 
parts,  operation  of  certain  actuator  valves,  extending  appendages  from  their  storage  compartments,  etc13.  Procedures 
to  disconnect  or  safe  the  charging  bank  of  capacitors  should  be  included  in  the  EOL  plan  to  prevent  accidental 
discharge  of  these  devices. 

4.  Radioactive  Material.  Depending  on  the  mission,  a  spacecraft  could  carry  radioactive  materials  onboard  for 
purposes  such  as  instrument  calibration,  as  a  heat  or  power  source,  as  structural  members  or  as  part  of  a  space 
experimental  payload17.  A  satellite  with  radioactive  material  would  likely  have  to  be  designed  with  enough  fuel  to 
reach  a  disposal  orbit,  due  to  the  possibility  of  that  material  surviving  re-entry  and  being  distributed  into  the 
atmosphere.  Various  US  and  international  regulations,  to  include  the  International  Atomic  Energy  Agency  (IAEA) 
Safety  Series  #6,  “Regulations  for  the  safe  transport  of  radioactive  material’’  18  would  govern  this  decision  and 
compliance  would  have  to  be  captured  in  the  EOL  plan. 

5.  Power  Design.  The  power  system  onboard  the  spacecraft,  with  special  reference  to  the  batteries,  are  the  most 
common  source  of  stored  energy  left  onboard.  Most  spacecraft  have  fault  protection  logic  built  into  their  automatic 
tasking  engines  (ATEs)  to  prevent  them  from  being  accidentally  commanded  off  or  from  being  discharged  beyond  a 
certain  critical  level.  If  such  logic  exists  it  may  not  be  possible  to  dissipate  battery  energy  as  easily.  Depending  on 
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the  satellite  configuration,  indirect  methods  to  bring  the  power  to  the  lowest  possible  configuration  should  be 
carefully  addressed. 

B.  Passivation  Sequence 

The  following  general  checklist  for  passivation  of  a  satellite  will  also  be  highly  dependent  on  the  spacecraft’s 
components  and  design13. 

1.  Start  of  EOL  procedures.  Firstly,  as  described  above,  stored  energy  sources  must  be  identified  and  measures  to 
minimize  or  dissipate  should  be  well  drawn  out.  Any  gas  or  liquid  filled  batteries,  pressurized  systems,  propellant 
lines  and  tanks  (regardless  of  tank  design)  and  control  moment  gyroscopes  must  be  depleted.  In  addition,  range 
safety  systems  must  be  deactivated. 

An  example  is  the  AFSPC  operational  asset  TacSat-3.  At  EOL,  this  vehicle  will  have  two  stored  energy  sources; 
the  reaction  wheels  and  the  charge  in  the  battery19.  By  design.  Mission  Engineers  (MEs)  have  the  ability  to  override 
all  fault  protection  and  autonomy  imposed  by  the  ATE.  Therefore  the  plan  for  passivation  for  TacSat-3  will  involve 
disabling  the  Peak  Power  Trackers  and  ensuring  they  do  not  enter  bypass  mode.  This  will  prevent  the  batteries  from 
charging  when  the  solar  arrays  are  exposed  to  the  sun,  instead  drawing  power  from  them  and  allowing  the 
momentum  wheels  to  spin  down. 

2.  Turning  off  non-essential  equipment.  All  non-essential  equipment  such  as  GPS,  Star  Trackers,  Inertial  Reference 
Units  (1RU),  back-up  power,  wide-band  transmitters,  Attitude  Determination  Control  Systems  (ADCS),  etc.,  should 
be  permanently  turned  off.  For  classification  sensitive  payloads,  appropriate  measures  to  ensure  that  no  one  else  can 
command  the  satellite  once  the  DoD  has  ceased  control  must  be  documented. 

Payloads  can  be  left  on  for  a  period  to  accelerate  discharging  of  the  battery,  but  should  be  turned  off  before  an 
under-voltage  trip  occurs.  Flowever,  sensitive  payloads  remaining  active  as  the  satellite’s  state  of  health  degenerates 
may  not  be  an  attractive  risk.  In  such  cases,  battery  discharge  may  be  accelerated  by  slewing  the  spacecraft  to  an 
anti-sun  attitude.  It  should  be  noted,  however,  that  when  the  Guidance,  Navigation  and  Control  (GN&C)  system  is 
placed  on  standby  (non-operational),  atmospheric  torques  may  cause  the  satellite  to  tumble,  possibly  lengthening  the 
time  for  discharge.  All  these  issues,  as  pertinent  to  the  satellite  at  hand,  should  be  carefully  balanced  to  ensure  the 
minimum  possible  energy  configuration. 

3.  Making  the  spacecraft  inert.  Once  all  measures  to  dissipate  stored  energy  aboard  the  satellite  are  complete  and 
only  those  systems  needed  to  complete  EOL  commanding  are  on-line,  the  spacecraft  is  considered  decommissioned. 
It  will  be  at  the  lowest  possible  energy  state  and  un-commandable  except  for  the  time -tagged  EOL  command  block 
uploaded  to  the  Spacecraft  Computer  (SCC)  that  will  turn  the  satellite  into  a  non-functional  piece  of  space  debris. 
This  will  complete  the  passivation  sequence. 

C.  Post-Passivation:  Debris  released  by  accidental  explosions 

Especially  once  the  spacecraft  is  beyond  commanding,  the  potential  for  accidental  explosions  due  to  thruster 
malfunctions,  tank  failures  due  to  small  debris  impact,  battery  ruptures,  structural  degradation  or  accidentally 
induced  high  rotation  rates20  can  be  high.  As  was  the  case  with  UARS,  if  the  satellite  is  approaching  burn-in, 
spacecraft  breakup  could  occur  during  the  final  orbit.  Therefore  a  crucial  part  of  reducing  the  orbital  safety  hazard  is 
capturing  and  quantifying  these  probabilities  in  an  EOL  plan,  if  they  exist. 

If  a  spacecraft  contains  any  of  the  systems  listed  below,  the  EOL  plan  must  incorporate  a  formal  Failure  Mode 
and  Effects  Analysis  (FMEA).  This  analysis  should  be  conducted  as  part  of  pre-launch  readiness  approvals,  and 
updated  prior  to  EOL13. 

1.  Range  safety.  Though  many  consider  the  space  shuttle’s  Solid  Rocket  Booster  (SRB)  range  safety  to  be  the  only 
publicly  necessary  mechanism,  to  prevent  civilian  casualties  in  the  event  of  a  deviated  launch  trajectory,  such  a 
picture  is  overly  simplistic.  Military  launches  are  a  large  percentage  of  space  activity,  and  the  cutting-edge  sensitive 
technology  they  carry  onboard  can  be  highly  desirable  to  foreign  nations.  When  executed  properly,  a  range  safety 
system  can  be  designed  to  minimize  orbital  debris;  however  it  is  estimated  that  nearly  20%  of  all  spacecraft 
breakups  may  be  attributed  to  the  unintentional  detonation  of  on-board  self-destruct  or  range-safety  systems20. 

2.  Hydraulic  systems.  Hydraulic  cylinders,  drive  systems  or  motors  find  use  in  propulsion  systems,  gimbal  servo 
actuators,  Thrust  Vector  Control  (TVC)  systems  and  in  power  systems  similar  to  the  Hydraulic  Power  Units  (HPUs) 
on  the  erstwhile  space  shuttle’s  SRBs.  Such  systems  typically  have  a  variety  of  pressurized  moving  parts  such  as 
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fuel  supply  modules,  hydraulic  reservoirs  and  fluid  manifold  assemblies,  and  can  present  a  significant  hazard  that 
must  be  addressed  as  part  of  EOL  planning. 

3.  Acoustic  generators.  Thermo -acoustic  generators  are  used  in  space  to  convert  heat  to  electricity  using  sound- 
based  generators.  In  addition,  piezoelectric  acoustic  generators  are  lightweight  and  free  from  RF  noise,  and  find  a 
variety  of  applications  in  satellite  microprocessors  and  amplification  or  oscillation  type  circuits  .  Another  example 
application  is  onboard  the  Cassini  spacecraft,  to  reduce  the  acoustic  environment  at  the  mountings  for  the  three 
onboard  radioisotope  thermoelectric  generators  (RTGs)21. 

The  FMEA’s  Risk  Priority  Numbers  (RPNs)  can  highlight  the  areas  of  greatest  concern  for  accidental 
explosions,  and  should  be  used  to  justify  any  recommended  passivation  decisions.  Excluding  the  case  of  on-orbit 
collisions,  which  is  discussed  in  section  IV,  AFI  91-217  now  requires  that  the  integrated  probability  of  explosion  be 
less  than  0.001  for  all  USAF  launches7.  The  FMEA  is  therefore  a  required  tool  to  calculate  the  failure  modes  of  each 
spacecraft,  probability  of  failure  and  integrated  probability  of  explosion  to  comply  with  USAF  and  AFSPC 
regulations. 


IV.  Other  Methods  Used  to  Mitigate  Orbital  Debris  at  EOL 

Lastly,  whenever  examining  orbital  debris  mitigation,  we  must  touch  on  intentional  breakup  activities  and  the 
probability  of  on-orbit  collisions  after  EOL  has  been  conducted.  The  latter  has  a  clear  relationship  to  the  disposal 
orbit  in  which  the  satellite  is  left,  and  how  quickly  that  orbit  is  decaying  into  the  atmosphere  with  time.  The  former 
is  trickier  in  light  of  the  obvious  military  utility  that  must,  at  times,  be  exercised  to  keep  sensitive  technology  out  of 
non-allied  hands.  The  USG  ODSPs  deal  with  this  vaguely,  stating  that  every  instance  of  planned  release  of  debris 
larger  than  5  mm  in  any  dimension  that  might  violate  the  25-year  re-entry  requirement  should  be  “evaluated  and 
justified  on  the  basis  of  cost  effectiveness  and  mission  requirements”1'2.  The  cost-effective  term  is  relevant  to 
relatively  cheap  technology  demonstrator  missions  such  as  cubesats,  wherein  it  may  not  be  feasible  to  add  propellant 
in  light  of  the  mission  budget.  The  mission  requirements  term  hints  at  intentional  breakup  activities,  which  are 
discussed  in  this  section. 

A.  Intentional  breakup  activities 

Examples  of  intentional  space  vehicle  breakup  debris  include  jettisoning  frangible  bolts  or  using  pyrotechnic 
devices  to  separate  the  spacecraft  from  its  payload  or  other  component  parts.  Intentional  breakup  has  also  been 
executed  as  part  of  structural  testing,  destroying  classified  equipment  aboard  military  satellites  to  prevent  recovery 
by  non-allied  nations,  space-borne  explosive  testing  and  in  Anti-Satellite  (ASAT)  and  other  space  weaponization 
testing12. 

However,  there  are  several  considerations  to  executing  an  intentional  explosion  or  collision.  The  growing 
concern  over  the  space  debris  problem  and  its  impact  on  current  space  operations  has  led  to  the  DoD  clamping  down 
on  such  intentional  debris  creation  activities.  An  excellent  example  of  space  operation  impact  is  China’s  recent 
destruction  of  its  Fengyun-lC  weather  satellite  with  an  ASAT  device.  Now  widely  viewed  as  the  most  severe 
fragmentation  in  50  years  of  space  operations,  NASA  estimates  that  the  breakup  of  Fengyun  caused  over  950  pieces 
of  space  debris  with  a  size  of  greater  than  10  centimeters;  each  with  a  velocity  in  excess  of  12  km/sec,  spanning  200 
to  3,800  kilometers  above  the  surface  of  the  Earth22. 

Current  National  Space  Policy  dictates  that  any  intentional  breakup  plans  must  be  approved  on  a  case-by-case 
basis  by  the  Secretary  of  Defense2.  In  addition,  the  USAF  requires  that  before  any  intentional  breakup  activities  ccan 
be  conducted,  it  must  be  conclusively  proven  that  for  24  hours  after  the  break-up,  the  probability  of  resulting  debris 
larger  than  1  mm  impacting  any  operating  spacecraft  is  no  greater  than  one  in  a  million  (probability  of  10"6)7. 

B.  On-orbit  collisions  after  EOL 

Two  categories  of  on-orbit  collisions  must  be  considered:  vulnerability  to  space  objects  smaller  than  10  cm  in 
diameter  and  to  objects  larger  than  10  cm  at  the  orbit  altitude  of  the  satellite.  It  is  generally  accepted7  that  objects 
larger  than  10  cm  can  cause  catastrophic  damage  to  a  satellite.  The  objective  is  for  maneuverable  satellites  to 
determine  if  the  current  altitude  is  the  most  optimal  for  executing  EOL,  taking  the  debris  and  potential  for  post-EOL 
collisions  at  that  altitude  into  consideration. 

Fig  1  below  shows  example  curves  for  the  number  of  predicated  impacts  vs.  altitude1’'  19  across  four  sizes  of 
orbital  debris  -  1  mm,  1  cm,  5  cm  and  10  cm.  The  analysis  shown  in  Fig  1  was  performed  using  DAS,  and  spans  a 
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timeframe  between  2012  and  2013.  This  is  in  fact  a  conservative  analysis.  Lips14  points  out  that  DAS  assumes 
higher  heat  capacities  and  emissivity  than  SCARAB  and  ORSAT,  possibly  artificially  increasing  the  survivability  of 
re-entering  parts. 


(km) 


|01  Diameter:  0.10  (cm) 
1 02  Diameter:  1.00  (cm) 
|03  Diameter:  10.00  (cm) 
04  Diameter:  5.00  (cm) 


Figure  1.  Impactor  Diameter  Threshold  Contours 


V.  Conclusion:  Design  for  Death 

The  problem  of  orbital  debris  is  not  a  fringe  problem  anymore.  As  this  paper  attempted  to  show,  there  is  enough 
regulation  to  ensure  that  all  agencies  and  personnel  involved  in  space  operations  are  aware  of  the  problem. 
Therefore,  as  responsible  stewards  of  space,  it  remains  our  responsibility  to  “design  for  death”,  i.e.,  to  make  sure 
that  the  designs  of  spacecraft,  launch  vehicles  and  missions  that  are  upcoming  have  taken  into  consideration  the 
orbital  debris  problem  and  have  a  mitigation  strategy  in  place  to  minimize  adding  to  the  problem.  The  trend  of  EOL 
considerations  (such  as  out  of  compliance  casualty  expectation  or  re-entry  projections)  coming  to  light  only  after  the 
Critical  Design  Review  (CDR),  at  which  point  it  is  not  cost-effective  to  design  mitigations  in,  should  be  avoided  as 
much  as  possible.  The  objective  of  all  these  standards  is  to  emphasize  the  concept  of  “design  for  death”,  i.e., 
designing  future  satellites  with  an  eye  on  its  end  of  mission. 

Satellite  EOL  planning  is  an  exhaustive  process  that  incorporates  many  elements,  many  of  which  have  links  to 
the  initial  design  process  of  the  satellite.  In  addition,  considering  the  problem  of  orbital  debris  during  and  after 
execution  of  EOL  will  require  foresight  and  planning,  as  well  as  adherence  to  guidance  and  instructions  put  in  place 
by  NASA  and/or  the  Department  of  Defense. 
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Appendix  A 
Acronym  List 

ADCS  Attitude  Determination  and  Control  System 

AFSPC  Air  Force  Space  Command 

ASAT  Anti  Satellite 

ATE  Automated  Tasking  Engine 

C4ISR  Command,  Control,  Communications,  Computers,  Intelligence,  Surveillance,  Reconnaissance 

DAS  Debris  Assessment  Software 

DOD  Department  of  Defense 

EOL  End  of  Life 

FMEA  Failure  Mode  and  Effects  Analysis 

GN&C  Guidance  Navigation  and  Control 

GPS  Global  Positioning  System 

FIPU  Flydraulic  Power  Unit 

IAEA  International  Atomic  Energy  Agency 

IRU  Inertial  Reference  Unit 

LEO  Low  Earth  Orbit 

ME  Mission  Engineer 

NASA  National  Aeronautics  and  Space  Administration 

NPR  NASA  Procedural  Requirement 

NSS  NASA  Safety  Standard 

ODSP  Orbital  Debris  Mitigation  Standard  Practices 

ORSAT  Object  Reentry  Survival  Analysis  Tool 

RPN  Risk  Priority  Number 

RTG  Radioisotope  Thermoelectric  Generators 

SCARAB  Spacecraft  Atmospheric  Reentry  and  Aerothermal  Breakup 

SCC  Spacecraft  Computer 

SESAM  Spacecraft  Entry  Survival  Analysis  Module 

STRATCOM  Strategic  Command 

TVC  Thrust  Vector  Control 

UARS  Upper  Atmospheric  Research  Satellite 

USAF  United  States  Air  Force 


USG  United  States  Government 
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